#include "suricata-common.h"
#include "suricata.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "app-layer-expectation.h"
#include "app-layer-ftp.h"
#include "app-layer-htp-range.h"
#include "app-layer-detect-proto.h"
#include "app-layer-frames.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp-private.h"
#include "stream-tcp-inline.h"
#include "stream-tcp.h"
#include "flow.h"
#include "flow-util.h"
#include "flow-private.h"
#include "ippair.h"
#include "util-debug.h"
#include "util-print.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "decode-events.h"
#include "app-layer-htp-mem.h"
#include "util-exception-policy.h"
#include "pkt-var.h"
#include "stream-tcp-util.h"
#include "stream.h"
#include "util-unittest.h"

Include dependency graph for app-layer.c:

Data Structures
struct	AppLayerThreadCtx_
	This is for the app layer in general and it contains per thread context relevant to both the alpd and alp. More...

struct	AppLayerCounterNames_

struct	AppLayerCounters_

Macros
#define	FLOW_PROTO_CHANGE_MAX_DEPTH 4096

#define	MAX_COUNTER_SIZE 64

#define	TEST_START

#define	TEST_END

Typedefs
typedef struct AppLayerCounterNames_	AppLayerCounterNames

typedef struct AppLayerCounters_	AppLayerCounters

Functions
void	AppLayerSetupCounters (void)

void	AppLayerDeSetupCounters (void)

void	AppLayerIncTxCounter (ThreadVars tv, Flow f, uint64_t step)

void	AppLayerIncGapErrorCounter (ThreadVars tv, Flow f)

void	AppLayerIncAllocErrorCounter (ThreadVars tv, Flow f)

void	AppLayerIncParserErrorCounter (ThreadVars tv, Flow f)

void	AppLayerIncInternalErrorCounter (ThreadVars tv, Flow f)

int	AppLayerHandleTCPData (ThreadVars tv, TcpReassemblyThreadCtx ra_ctx, Packet p, Flow f, TcpSession ssn, TcpStream stream, uint8_t data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir app_update_dir)
	handle TCP data for the app-layer. More...

int	AppLayerHandleUdp (ThreadVars tv, AppLayerThreadCtx tctx, Packet p, Flow f)
	Handle a app layer UDP message. More...

AppProto	AppLayerGetProtoByName (char *alproto_name)
	Given a protocol string, returns the corresponding internal protocol id. More...

const char *	AppLayerGetProtoName (AppProto alproto)
	Given the internal protocol id, returns a string representation of the protocol. More...

void	AppLayerListSupportedProtocols (void)

int	AppLayerSetup (void)
	Setup the app layer. More...

int	AppLayerDeSetup (void)
	De initializes the app layer. More...

AppLayerThreadCtx *	AppLayerGetCtxThread (void)
	Creates a new app layer thread context. More...

void	AppLayerDestroyCtxThread (AppLayerThreadCtx *app_tctx)
	Destroys the context created by AppLayerGetCtxThread(). More...

void	AppLayerProfilingResetInternal (AppLayerThreadCtx *app_tctx)

void	AppLayerProfilingStoreInternal (AppLayerThreadCtx app_tctx, Packet p)

void	AppLayerRegisterGlobalCounters (void)
	HACK to work around our broken unix manager (re)init loop. More...

void	AppLayerRegisterThreadCounters (ThreadVars *tv)
	Registers per flow counters for all protocols. More...

void	AppLayerUnittestsRegister (void)

Variables
bool	g_stats_eps_per_app_proto_errors

AppLayerCounterNames	applayer_counter_names [FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]

AppLayerCounters	applayer_counters [FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]

ExceptionPolicyCounters	eps_error_summary

ExceptionPolicyStatsSetts	app_layer_error_eps_stats

enum ExceptionPolicy	g_applayerparser_error_policy

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t; Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Generic App-layer functions

Definition in file app-layer.c.

Macro Definition Documentation

◆ FLOW_PROTO_CHANGE_MAX_DEPTH

#define FLOW_PROTO_CHANGE_MAX_DEPTH 4096

Definition at line 76 of file app-layer.c.

◆ MAX_COUNTER_SIZE

#define MAX_COUNTER_SIZE 64

Definition at line 78 of file app-layer.c.

◆ TEST_END

#define TEST_END

Value:

    StreamTcpSessionClear(p->flow->protoctx);                                                      \
    StreamTcpThreadDeinit(&tv, (void *)stt);                                                       \
    StreamTcpFreeConfig(true);                                                                     \
    PacketFree(p);                                                                                 \
    FLOW_DESTROY(&f);                                                                              \
    StatsThreadCleanup(&tv);

Definition at line 1411 of file app-layer.c.

◆ TEST_START

#define TEST_START

Definition at line 1329 of file app-layer.c.

Typedef Documentation

◆ AppLayerCounterNames

typedef struct AppLayerCounterNames_ AppLayerCounterNames

◆ AppLayerCounters

typedef struct AppLayerCounters_ AppLayerCounters

Function Documentation

◆ AppLayerDeSetup()

int AppLayerDeSetup ( void )

De initializes the app layer.

   Includes de initializing protocol detection and the protocol parser.

Definition at line 1048 of file app-layer.c.

References AppLayerDeSetupCounters(), AppLayerParserDeSetup(), AppLayerProtoDetectDeSetup(), SCEnter, and SCReturnInt.

Referenced by GlobalsDestroy().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerDeSetupCounters()

void AppLayerDeSetupCounters ( void )

Definition at line 1314 of file app-layer.c.

References applayer_counter_names, and applayer_counters.

Referenced by AppLayerDeSetup().

Here is the caller graph for this function:

◆ AppLayerDestroyCtxThread()

void AppLayerDestroyCtxThread ( AppLayerThreadCtx * tctx )

Destroys the context created by AppLayerGetCtxThread().

Parameters

tctx	Pointer to the thread context to destroy.

Definition at line 1081 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerParserThreadCtxFree(), AppLayerProtoDetectDestroyCtxThread(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerGetCtxThread(), DecodeThreadVarsFree(), and StreamTcpReassembleFreeThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerGetCtxThread()

AppLayerThreadCtx* AppLayerGetCtxThread ( void )

Creates a new app layer thread context.

Return values

Pointer to the newly create thread context, on success; NULL, on failure.

Definition at line 1060 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerDestroyCtxThread(), AppLayerParserThreadCtxAlloc(), AppLayerProtoDetectGetCtxThread(), SCCalloc, SCEnter, and SCReturnPtr.

Referenced by DecodeThreadVarsAlloc(), and StreamTcpReassembleInitThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerGetProtoByName()

AppProto AppLayerGetProtoByName ( char * alproto_name )

Given a protocol string, returns the corresponding internal protocol id.

Parameters

The	internal protocol id.

Definition at line 999 of file app-layer.c.

References AppLayerProtoDetectGetProtoByName(), SCEnter, and SCReturnCT.

Here is the call graph for this function:

◆ AppLayerGetProtoName()

const char* AppLayerGetProtoName ( AppProto alproto )

Given the internal protocol id, returns a string representation of the protocol.

Parameters

alproto The internal protocol id.

Return values

String representation of the protocol.

Definition at line 1006 of file app-layer.c.

References AppLayerProtoDetectGetProtoName(), SCEnter, and SCReturnCT.

Referenced by AppLayerListSupportedProtocols().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerHandleTCPData()

int AppLayerHandleTCPData	(	ThreadVars *	tv,
		TcpReassemblyThreadCtx *	ra_ctx,
		Packet *	p,
		Flow *	f,
		TcpSession *	ssn,
		TcpStream **	stream,
		uint8_t *	data,
		uint32_t	data_len,
		uint8_t	flags,
		enum StreamUpdateDir	app_update_dir
	)

handle TCP data for the app-layer.

Handles reassembled tcp stream.

First run protocol detection and then when the protocol is known invoke the app layer parser.

Parameters

stream ptr-to-ptr to stream object. Might change if flow dir is reversed.

Definition at line 708 of file app-layer.c.

References Flow_::alproto, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, TcpReassemblyThreadCtx_::app_tctx, DEBUG_ASSERT_FLOW_LOCKED, DEBUG_VALIDATE_BUG_ON, flags, TcpSession_::flags, SCEnter, SCLogDebug, STREAMTCP_FLAG_APP_LAYER_DISABLED, and StreamTcpSetStreamFlagAppProtoDetectionCompleted.

Referenced by StreamTcpReassembleAppLayer().

Here is the caller graph for this function:

◆ AppLayerHandleUdp()

int AppLayerHandleUdp	(	ThreadVars *	tv,
		AppLayerThreadCtx *	tctx,
		Packet *	p,
		Flow *	f
	)

Handle a app layer UDP message.

Handles an udp chunk.

If the protocol is yet unknown, the proto detection code is run first.

Parameters

dp_ctx	Thread app layer detect context
f	locked flow
p	UDP packet

Return values

0	ok
-1	error

Definition at line 875 of file app-layer.c.

References AppLayerThreadCtx_::alpd_tctx, Flow_::alproto, ALPROTO_FAILED, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, Packet_::app_layer_events, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS, AppLayerDecoderEventsSetEventRaw(), AppLayerProfilingReset, AppLayerProtoDetectGetProto(), flags, FLOW_PKT_TOSERVER, Packet_::flowflags, PACKET_PROFILING_APP_PD_END, PACKET_PROFILING_APP_PD_START, Packet_::payload, Packet_::payload_len, SCEnter, SCLogDebug, and SCReturnInt.

Here is the call graph for this function:

◆ AppLayerIncAllocErrorCounter()

void AppLayerIncAllocErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 170 of file app-layer.c.

References AppLayerCounters_::alloc_error_id, Flow_::alproto, applayer_counters, likely, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncGapErrorCounter()

void AppLayerIncGapErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 162 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::gap_error_id, likely, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncInternalErrorCounter()

void AppLayerIncInternalErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 186 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::internal_error_id, likely, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncParserErrorCounter()

void AppLayerIncParserErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 178 of file app-layer.c.

References Flow_::alproto, applayer_counters, likely, AppLayerCounters_::parser_error_id, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncTxCounter()

void AppLayerIncTxCounter	(	ThreadVars *	tv,
		Flow *	f,
		uint64_t	step
	)

Definition at line 154 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::counter_tx_id, likely, Flow_::protomap, StatsAddUI64(), and tv.

Here is the call graph for this function:

◆ AppLayerListSupportedProtocols()

void AppLayerListSupportedProtocols ( void )

Definition at line 1013 of file app-layer.c.

References ALPROTO_MAX, AppLayerGetProtoName(), AppLayerProtoDetectSupportedAppProtocols(), SCEnter, and SCReturn.

Referenced by ListAppLayerProtocols().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerProfilingResetInternal()

void AppLayerProfilingResetInternal ( AppLayerThreadCtx * app_tctx )

Definition at line 1098 of file app-layer.c.

References PACKET_PROFILING_APP_RESET.

◆ AppLayerProfilingStoreInternal()

void AppLayerProfilingStoreInternal	(	AppLayerThreadCtx *	app_tctx,
		Packet *	p
	)

Definition at line 1103 of file app-layer.c.

References PACKET_PROFILING_APP_STORE.

◆ AppLayerRegisterGlobalCounters()

void AppLayerRegisterGlobalCounters ( void )

HACK to work around our broken unix manager (re)init loop.

Definition at line 1111 of file app-layer.c.

References ExpectationGetCounter(), FTPMemcapGlobalCounter(), FTPMemuseGlobalCounter(), HostGetMemcap(), HostGetMemuse(), HTPByteRangeMemcapGlobalCounter(), HTPByteRangeMemuseGlobalCounter(), HTPMemcapGlobalCounter(), HTPMemuseGlobalCounter(), IPPairGetMemuse(), and StatsRegisterGlobalCounter().

Referenced by PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerRegisterThreadCounters()

void AppLayerRegisterThreadCounters ( ThreadVars * tv )

Registers per flow counters for all protocols.

Definition at line 1250 of file app-layer.c.

References ALPROTO_MAX, AppLayerProtoDetectSupportedAppProtocols(), EXCEPTION_POLICY_MAX, EXCEPTION_POLICY_NOT_SET, and g_applayerparser_error_policy.

Here is the call graph for this function:

◆ AppLayerSetup()

int AppLayerSetup ( void )

Setup the app layer.

   Includes protocol detection setup and the protocol parser setup.

Return values

0	On success.
-1	On failure.

Definition at line 1033 of file app-layer.c.

References AppLayerParserRegisterProtocolParsers(), AppLayerParserSetup(), AppLayerProtoDetectPrepareState(), AppLayerProtoDetectSetup(), AppLayerSetupCounters(), SCEnter, and SCReturnInt.

Referenced by ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerSetupCounters()

void AppLayerSetupCounters ( void )

Definition at line 1150 of file app-layer.c.

References ALPROTO_MAX, EXCEPTION_POLICY_MAX, EXCEPTION_POLICY_NOT_SET, g_applayerparser_error_policy, and str.

Referenced by AppLayerSetup().

Here is the caller graph for this function:

◆ AppLayerUnittestsRegister()

void AppLayerUnittestsRegister ( void )

Definition at line 2953 of file app-layer.c.

References SCEnter, and UtRegisterTest().

Here is the call graph for this function:

Variable Documentation

◆ app_layer_error_eps_stats

ExceptionPolicyStatsSetts app_layer_error_eps_stats

Initial value:

= {
    .valid_settings_ids = {
             false,
                false,
         true,
           true,
         true,
         false,
           false,
              true,
    },
    .valid_settings_ips = {
             false,
                false,
         true,
           true,
         true,
         true,
           true,
              true,
    },
}

Definition at line 107 of file app-layer.c.

◆ applayer_counter_names

AppLayerCounterNames applayer_counter_names[FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]

Definition at line 99 of file app-layer.c.

Referenced by AppLayerDeSetupCounters().

◆ applayer_counters

AppLayerCounters applayer_counters[FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]

Definition at line 101 of file app-layer.c.

Referenced by AppLayerDeSetupCounters(), AppLayerIncAllocErrorCounter(), AppLayerIncGapErrorCounter(), AppLayerIncInternalErrorCounter(), AppLayerIncParserErrorCounter(), and AppLayerIncTxCounter().

◆ eps_error_summary

ExceptionPolicyCounters eps_error_summary

Definition at line 103 of file app-layer.c.

◆ g_applayerparser_error_policy

enum ExceptionPolicy g_applayerparser_error_policy

Definition at line 1 of file app-layer-parser.c.

Referenced by AppLayerRegisterThreadCounters(), and AppLayerSetupCounters().

◆ g_stats_eps_per_app_proto_errors

bool g_stats_eps_per_app_proto_errors

add per-proto app-layer error counters for exception policies stats? disabled by default

Definition at line 213 of file suricata.c.

Referenced by PostConfLoadedSetup().

Data Structures

Macros

Typedefs

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ FLOW_PROTO_CHANGE_MAX_DEPTH

◆ MAX_COUNTER_SIZE

◆ TEST_END

◆ TEST_START

Typedef Documentation

◆ AppLayerCounterNames

◆ AppLayerCounters

Function Documentation

◆ AppLayerDeSetup()

◆ AppLayerDeSetupCounters()

◆ AppLayerDestroyCtxThread()

◆ AppLayerGetCtxThread()

◆ AppLayerGetProtoByName()

◆ AppLayerGetProtoName()

◆ AppLayerHandleTCPData()

◆ AppLayerHandleUdp()

◆ AppLayerIncAllocErrorCounter()

◆ AppLayerIncGapErrorCounter()

◆ AppLayerIncInternalErrorCounter()

◆ AppLayerIncParserErrorCounter()

◆ AppLayerIncTxCounter()

◆ AppLayerListSupportedProtocols()

◆ AppLayerProfilingResetInternal()

◆ AppLayerProfilingStoreInternal()

◆ AppLayerRegisterGlobalCounters()

◆ AppLayerRegisterThreadCounters()

◆ AppLayerSetup()

◆ AppLayerSetupCounters()

◆ AppLayerUnittestsRegister()

Variable Documentation

◆ app_layer_error_eps_stats

◆ applayer_counter_names

◆ applayer_counters

◆ eps_error_summary

◆ g_applayerparser_error_policy

◆ g_stats_eps_per_app_proto_errors